From e315c137bf41bedfa8f0df537f2c3f6ab45b7e60 Mon Sep 17 00:00:00 2001
From: Manuel <5673677+mtrezza@users.noreply.github.com>
Date: Mon, 15 Jan 2024 00:47:03 +0100
Subject: [PATCH] fix: Username is `undefined` in email verification link on
 email change (#8887)

---
 spec/ValidationAndPasswordsReset.spec.js | 1 +
 src/Controllers/UserController.js        | 5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/spec/ValidationAndPasswordsReset.spec.js b/spec/ValidationAndPasswordsReset.spec.js
index 5b450c1e68..0845abeda1 100644
--- a/spec/ValidationAndPasswordsReset.spec.js
+++ b/spec/ValidationAndPasswordsReset.spec.js
@@ -137,6 +137,7 @@ describe('Custom Pages, Email Verification, Password Reset', () => {
     spyOn(emailAdapter, 'sendVerificationEmail').and.callFake(options => {
       expect(options.link).not.toBeNull();
       expect(options.link).not.toMatch(/token=undefined/);
+      expect(options.link).not.toMatch(/username=undefined/);
       Promise.resolve();
     });
     const user = new Parse.User();
diff --git a/src/Controllers/UserController.js b/src/Controllers/UserController.js
index d2dcbcd1df..ba72b476a1 100644
--- a/src/Controllers/UserController.js
+++ b/src/Controllers/UserController.js
@@ -161,7 +161,8 @@ export class UserController extends AdaptableController {
       return;
     }
     const token = encodeURIComponent(user._email_verify_token);
-    // We may need to fetch the user in case of update email
+    // We may need to fetch the user in case of update email; only use the `fetchedUser`
+    // from this point onwards; do not use the `user` as it may not contain all fields.
     const fetchedUser = await this.getUserIfNeeded(user);
     let shouldSendEmail = this.config.sendUserEmailVerification;
     if (typeof shouldSendEmail === 'function') {
@@ -176,7 +177,7 @@ export class UserController extends AdaptableController {
     if (!shouldSendEmail) {
       return;
     }
-    const username = encodeURIComponent(user.username);
+    const username = encodeURIComponent(fetchedUser.username);
 
     const link = buildEmailLink(this.config.verifyEmailURL, username, token, this.config);
     const options = {